OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.


Help: OASIS Mailing Lists Help | MarkMail Help

cti-stix message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]

Subject: Re: [cti-stix] external-references keywords

Hm, not sure about this. I like having a separate URL and ID field as Rich has outlined it…that way you can provide both the URL and the ID, in particular for cases where you might not be able to automatically built the URL from the ID. Or in cases where the consumers want to show or pivot on the ID but still be able to link to the URL (his second example).


From: <cti-stix@lists.oasis-open.org> on behalf of Allan Thomson <athomson@lookingglasscyber.com>
Date: Tuesday, May 31, 2016 at 2:01 PM
To: Rich Piazza <rpiazza@mitre.org>, "cti-stix@lists.oasis-open.org" <cti-stix@lists.oasis-open.org>
Subject: Re: [cti-stix] external-references keywords


Rich – I think external_id and url can be combined into a single attribute “ref” or similar.


Source could be an ov.




From: "cti-stix@lists.oasis-open.org" <cti-stix@lists.oasis-open.org> on behalf of "Piazza, Rich" <rpiazza@mitre.org>
Date: Tuesday, May 31, 2016 at 10:43 AM
To: "cti-stix@lists.oasis-open.org" <cti-stix@lists.oasis-open.org>
Subject: [cti-stix] external-references keywords


Hi everyone,


I think these four keywords would cover all of the external reference details.  I’ve including some examples below.  Can anyone think of some external reference that couldn’t be specified using these keywords?






external_references: array of {

                description : string

                external_id: string

                source: ov?

                url: url



Any combination is legal






[ { “source”: “capec”, “external_id”: “capec-550” } ]




[ { “source”: “capec”, “external_id”: “capec-550”, “url”:  “http://capec.mitre.org/data/definitions/550.html”} ]




[{ “description”: “APT1 report”, “url”: “http://intelreport.mandiant.com/Mandiant_APT1_Report.pdf”}]




[{“source”: “veris”, “external_id”: “00C84D6A-CDB8-4A5B-A1A6-0D75A65274D7”}]




[{“source”: “jira”, “external_id”: “TAB-1370”, “url”: “https://issues.oasis-open.org/browse/TAB-1370”}]







[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]